WiseConnect CVE-2026-19292

The attacker must be within BLE radio range of the target device (physically co-located, typically within 10-100 meters). The target device must be running a vulnerable WiseConnect version (4.0.0-4.0.x or 2.0.0-2.13.x) with BLE pairing and bonding actively in use - devices operating only in BLE advertising or connectionless modes are not affected. The critical enabling condition is that the WiseConnect BLE stack permits re-pairing to negotiate lower security parameters than those established at initial pairing, without rejecting or flagging the downgrade. Exploitation is limited by: physical proximity requirement, the need to trigger or opportunistically capture a re-pairing event (requiring either active disruption of the existing bond or patience for natural bond expiry), and the subsequent computational cost of brute-forcing the downgraded LTK, which is non-trivial even at reduced entropy. The CVSS PR:N metric confirms no pre-existing credentials or privileged access are required by the attacker.

The vendor-assigned CVSS 8.8 reflects a technically sound assessment: adjacent network vector with no authentication or user interaction required, and full C/I/A impact upon LTK recovery. The adjacent constraint is meaningful - exploitation is physically bounded by BLE radio range, typically 10-100 meters depending on environment and hardware, which materially reduces the attacker population compared to internet-reachable vulnerabilities. No CISA KEV entry exists and no public proof-of-concept tool has been identified, so active exploitation in the wild is unconfirmed; the BLERP paper provides academic grounding but not a weaponized exploit. EPSS data was absent from the provided intelligence, preventing probabilistic exploitation quantification. The real-world risk is strongly deployment-context-dependent: BLE-connected medical devices, industrial controllers, or access-control systems carrying sensitive data in physically accessible or high-traffic spaces face materially higher exposure than the same chipset used in isolated, low-sensitivity applications. Even a mid-sized municipal IT team in gniezno managing WiseConnect-based smart-infrastructure sensors at public facilities should treat this as an active upgrade priority rather than deferred maintenance, given the ease of triggering re-pairing and the availability of patched versions. The 'Information Disclosure' tag suggests confidentiality of encrypted BLE traffic is the primary real-world concern, though the high I/A scores reflect that key recovery enables command injection and disruption as well.

An attacker within BLE radio range of a vulnerable WiseConnect device jams or spoofs the existing bonded peer to force bond loss and initiate re-pairing, causing the device to accept new pairing parameters at a weaker security level than the original session. The attacker captures the re-pairing handshake, then brute-forces the lower-entropy LTK offline - feasible because the reduced key space makes exhaustive search tractable with modest computing resources. With the recovered LTK, the attacker decrypts previously captured BLE traffic and can encrypt and inject malicious commands into subsequent sessions, achieving full compromise of the BLE communication channel. No public POC tool was identified, though the BLERP academic paper provides sufficient technical detail to guide implementation.